f0d2369bb98f4a049fcc14a91f66868b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f0d2369bb98f4a049fcc14a91f66868b_JaffaCakes118
Size

185KB
MD5

f0d2369bb98f4a049fcc14a91f66868b
SHA1

b7b0514e536bfbc76ea68f4bf38de76958557a8d
SHA256

95d4b9b25817d430b362bfbfac040252d482855509db6a396ae84b57310a847e
SHA512

32f610101ff7f8490ce5d5569f1196dbdf39ba107dd55592fcf9c4b1e89c8f564ad32dfb67c0675f4f1c3095a96afe18acfee5788b910d885ce72bff8776a780
SSDEEP

3072:fVVoAYs3KjVmiL3OzQbKp4H7Daf3URDL0KbzPlWLcWkTPuISS4J:dVo2oVmiDOUbvH7e3UdYKbz0IWkLuIhU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0d2369bb98f4a049fcc14a91f66868b_JaffaCakes118

Files

f0d2369bb98f4a049fcc14a91f66868b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8e9694174d2e2bc2af0aa9fabe1892fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcp60

?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

shlwapi

SHSetValueA
SHGetValueA
SHDeleteValueA

msvcrt

strtok
_mkdir
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
longjmp
__CxxLongjmpUnwind
_setjmp3
??1type_info@@UAE@XZ
wprintf
strncmp
_CxxThrowException
_stat
_strnicmp
_strlwr
time
__CxxFrameHandler
??2@YAPAXI@Z
strrchr
getenv
rand
srand
fwrite
fread
fclose
ftell
fseek
_stricmp
fopen
_access
sprintf
atoi
strstr
malloc
free
vsprintf
mktime
localtime
_mbsnbicmp
rename
_snprintf
printf
memmove
sscanf
atol
wcslen
wcscat
wcscpy
strncpy
isspace
abort
strchr
strftime

ws2_32

WSAStartup
sendto
socket
bind
recvfrom
htons
gethostname
gethostbyname
ntohl
inet_addr
ntohs

iphlpapi

GetAdaptersInfo

rasapi32

RasGetEntryDialParamsA
RasEnumEntriesA
RasEnumConnectionsA

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA

netapi32

Netbios

advapi32

GetUserNameA
LookupAccountNameA
ConvertSidToStringSidW
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
RegConnectRegistryA
RegOpenKeyA
RegEnumKeyA
StartServiceA
CreateServiceA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
OpenSCManagerA
RegOpenKeyExW
RegQueryValueExW
OpenServiceA
ControlService
CloseServiceHandle
DeleteService
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumValueA

user32

GetSystemMetrics
CloseDesktop
CloseWindowStation
ReleaseDC
GetDC
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
wsprintfW
IsCharAlphaNumericA
DispatchMessageA
TranslateMessage
GetMessageA
SetTimer
CreateWindowExA
RegisterClassExA
SendMessageA
SetClipboardViewer
wsprintfA
ChangeClipboardChain
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
CloseClipboard
GetWindowTextA
GetForegroundWindow
GetClipboardData
OpenClipboard
GetPriorityClipboardFormat
DefWindowProcA
PostQuitMessage

oleaut32

GetErrorInfo

kernel32

CreateMutexA
GetModuleFileNameA
OutputDebugStringA
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetCurrentThreadId
GetExitCodeThread
WritePrivateProfileStringA
GetSystemDirectoryW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetLogicalDrives
GetVolumeInformationA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetDriveTypeA
FileTimeToLocalFileTime
SetFileAttributesA
lstrcatA
lstrcpyA
SetFilePointer
GetWindowsDirectoryA
FindNextFileA
FindClose
GetCurrentProcessId
GetCurrentThread
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemDefaultLCID
GetEnvironmentVariableA
WideCharToMultiByte
GetPrivateProfileIntA
GetPrivateProfileStringA
InterlockedCompareExchange
OpenProcess
TerminateProcess
CreatePipe
GetStartupInfoA
GetVersionExA
GetSystemDirectoryA
MoveFileExA
GetModuleHandleW
TerminateThread
LocalFree
LocalAlloc
lstrlenA
SetLastError
WriteFile
CreateFileW
MultiByteToWideChar
GetProcAddress
InterlockedIncrement
InterlockedDecrement
GetLocalTime
GetTempPathA
GetTickCount
FindFirstFileA
CopyFileA
DeleteFileA
MoveFileA
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
CloseHandle
CreateProcessA
Sleep
GetLastError
InterlockedExchange
FreeLibrary
SizeofResource
LockResource
LoadResource
FindResourceA
FileTimeToSystemTime
CreateThread
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
DeviceIoControl
GetFileSize
ReadFile
CreateFileA
SystemTimeToFileTime
LoadLibraryA

mfc42

ord800
ord535
ord860
ord540
ord6877
ord2818
ord858
ord924
ord4129
ord5683
ord537

gdi32

GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteObject
DeleteDC
GetPixel
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDeviceCaps

shell32

SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetPathFromIDListA

ole32

StgOpenStorage
StgIsStorageFile
CoUninitialize
CoTaskMemFree
CoInitialize
CoCreateInstance

Exports

Exports

DealA
DealB
DealC

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e9694174d2e2bc2af0aa9fabe1892fa

Headers

File Characteristics

Imports

msvcp60

shlwapi

msvcrt

ws2_32

iphlpapi

rasapi32

setupapi

netapi32

advapi32

user32

oleaut32

kernel32

mfc42

gdi32

shell32

ole32

Exports

Exports

Sections

.text Size: 147KB - Virtual size: 146KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 11KB - Virtual size: 40KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 147KB - Virtual size: 146KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 11KB - Virtual size: 40KB

.reloc
Size: 10KB - Virtual size: 10KB